Quantum Distribution of Gaussian Keys with Squeezed States 
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A continuous key distribution scheme is proposed that relies on a pair of canonically conjugate 
quantum variables. It allows two remote parties to share a secret Gaussian key by encoding it 
into one of the two quadrature components of a single-mode electromagnetic field. The resulting 
quantum cryptographic information vs disturbance tradeoff is investigated for an individual attack 
based on the optimal continuous cloning machine. It is shown that the information gained by the 
eavesdropper then simply equals the information lost by the receiver. 
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Quantum cryptography — or, more precisely, quantum 
key distribution — is a technique that allows two remote 
parties to share a secret chain of random bits (a secret 
key) that can be used for exchanging encrypted infor- 
mation The security of this process fundamen- 
tally relies on the Heisenberg uncertainty principle, or 
on the fact that any measurement of incompatible vari- 
ables inevitably affects the state of a quantum system. 
Any leak of information to an eavesdropper necessarily 
induces a disturbance of the system, which is, in princi- 
ple, detectable by the authorized receiver. 

In most quantum cryptosystems proposed so far, a sin- 
gle photon (or, in practice, a weak coherent state with an 
average photon number lower than one) is used to carry 
each bit of the key. Mathematically, the security is based 
on the use of a pair of non-commuting observables such 
as the x- and z-projections of a spin-1/2 particle, a x and 
a z , whose eigenstates are used to encode the key. The 
sender (Alice) randomly chooses to encode the key using 
either a z (0 is encoded as | f) and 1 as | |)) or a x (0 is en- 
coded as 2~ 1 / 2 (| t) + | |» and 1 as 2- 1 / 2 (| |) - | I))), the 
choice of the basis being disclosed only after the receiver 
(Bob) has measured the photon. This guarantees that an 
eavesdropper (Eve) cannot read the key without corrupt- 
ing the transmission. Such a procedure, known as BB84 
, is at the heart of most of the quantum cryptographic 
schemes that have been experimentally demonstrated in 
the past few years, which are based either on the polar- 
ization (e. g. |§,||) or the optical phase (e. g. of single 
photons. An alternative scheme, realized experimentally 
only a year ago (?]-||] , can also be used based on a pair of 
pol arization-entangled photons instead of single photons 
|[10|| . It is, however, fundamentally equivalent to BB84 
(see [[ll|) and it again relies on the algebra of spin-1/2 
particles. 

Recently, it has been shown that another protocol for 
quantum key distribution can be devised based on con- 
tinuous variables, where squeezed coherent light modes 
are used to carry the key Q-Q. In these techniques, 
one exploits a pair of (continuous) canonical variables 
such as the two quadratures X\ and Xi of the ampli- 
tude of a mode of the electromagnetic field, which be- 



have just as position and momentum. The uncertainty 
relation AA"i A X2 > 1/4 then implies than Eve can- 
not read both quadrature components without degrading 
the state. Even though the experimental preparation of 
squeezed states is a difficult task, these schemes circum- 
vent a main weakness of the above-mentioned cryptosys- 
tems that is the critical dependence of their security on 
the ability of preparing single-photon states. 

In this paper, we propose an alternative squeezed-state 
quantum cryptographic scheme, which provides a means 
to distribute a continuous secret key. The goal of our 
protocol is to have Alice and Bob sharing a continuous 
key that consists of a random list of Gaussian-distributed 
variables that cannot be known to Eve. Thus, in this sce- 
nario, both the key and the quantum variable that carries 
it are continuous. This is in contrast with the schemes 
proposed in Ref. Jl^-|T^], which appear hybrid as a con- 
tinuous quantum variable was used to carry a discrete 
key element (the shared key was made of bits, or, in 
general, discrete variables). Instead, our approach can 
be viewed as an all-continuous quantum cryptographic 
scheme, which is the proper continuous extension of the 
BB84 scheme. First, from a theoretical perspective, this 
provides a more satisfying continuous treatment of quan- 
tum key distribution. Remarkably, the tradeoff between 
Eve's information gain and the disturbance at Bob's sta- 
tion can be expressed in an unexpectedly simple way (if 
we restrict ourselves to an individual attack based on the 
optimal continuous cloning machine): the information 
gained by Eve on one quadrature is at most equal to the 
information lost by Bob on the other quadrature. This re- 
sults in a simple information-theoretic measure of the dis- 
turbance, namely the defect of information at Bob's sta- 
tion. Moreover, this all-continuous scheme avoids a po- 
tential attack against the scheme proposed in Ref. 
by filling in the gaps between the values used to encode 
the discrete key values (this will be explained later on). 

Let us now detail our protocol. The uncertainty re- 
lation implies that it is impossible to measure with full 
accuracy both quadratures of a single mode, X\ and X2. 
Alice exploits this property by encoding the key elements 
(random Gaussian samples) as a quadrature squeezed 
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state either in X\ or in X 2 , in such a way that an eaves- 
dropper ignoring which of these two "bases" is used can- 
not acquire information without disturbing the state. In 
basis 1, Alice prepares a squeezed vacuum state such that 
the fluctuations of X\ are squeezed (AA 2 = cr\ < 1/4), 
and then applies a displacement of X% by an amount 
equal to the value of the Gaussian key ((Xi) = x, where 
x is the encoded key element). The quantity a\ refers 
here to the intrinsic variance of X\ in the squeezed state; 
the corresponding squeeze parameter is r% — — ln(2<7i). 
We denote by E 2 the variance of this Gaussian key, so 
the mean value (X\) is itself distributed as a Gaussian 
of mean and variance Ef . Conversely, in basis 2, Alice 
sends a squeezed state in X 2 (AXf = erf < 1/4), whose 
displacement encodes the Gaussian key ((X2) = x). 
Again, (X 2 ) has a Gaussian profile with mean and 
variance E 2 ,, while the squeeze parameter in mode 2 is 
r 2 = — ln(2(J2). Thus, in both basis, Alice encodes the 
key into a displaced vacuum squeezed state, the squeezing 
(by r) and displacement (by x) being applied at random 
on Xi or X 2 . 

Now, for the cryptographic setup to be secure, we re- 
quire the statistical distribution of the X\ measurement 
outcomes to be indistinguishable whether basis 1 or 2 
is used by Alice. If this condition is fulfilled, Eve can- 
not obtain any indication on whether she is measuring 
a type 1 or type 2 squeezed state, whatever the statis- 
tics she accumulates. If basis 1 is used, the outcomes 
of Xi measurements (that can be obtained in practice 
by homodyne detection) are distributed as a Gaussian of 
variance E 2 + a\ since each squeezed state gives an extra 
contribution of a\ to the variance. If, on the contrary, 
a type 2 squeezed state is measured, then the outcomes 
of X\ measurements exhibit a Gaussian distribution of 
variance l/(16cr|) as a result of the uncertainty princi- 
ple. Thus, we impose the condition 

E? + of = l/(16a|) (1) 

Similarly, the requirement that type 1 and 2 squeezed 
states are indistinguishable when performing X 2 mea- 
surements implies that Ef, + erf = l/(16<rf). These two 
relations can be summarized as 

1 + E 2 / a\ = 1 + E 2 /<7 2 = 1/a 2 (2) 

where a = 4a\a 2 = e~( ri+r2 ) is a (positive) dimension- 
less constant which must satisfy a < 1 (or o\a?, < 1/4) 
for Eq. (En to be consistent. More generally, these two 
conditions guarantee that the density matrices of the en- 
coded key elements are the same in bases 1 and 2, making 
them indistinguishable. Thus, choosing the squeeze pa- 
rameters r\ and r 2 is sufficient to completely characterize 
the protocol. 

Let us now analyze the transmission of the Gaussian 
key elements in the case where there is no eavesdropper 
and the transmission is perfect. We first need to recall 
some standard notions of Shannon theory concerning the 
treatment of continuous transmission channels. Consider 



a discrete-time continuous channel which adds a Gaus- 
sian noise of variance a 2 on each signal. If the input x of 
the channel is a Gaussian signal of variance E 2 , the uncer- 
tainty on x can be measured by the differential Shannon 
entropy h(x) — 2~ 1 log 2 (27reE 2 ) bits jig] . Conditionally 
on x, the output y is distributed as a Gaussian of variance 
a 2 , so that the entropy of y conditionally on x becomes 
h(y\x) = 2 _1 log 2 (27re<7 2 ) bits. Now, the distribution 
of y is given by the convolution of these two Gaussians, 
i. e., a Gaussian of variance E 2 + a 2 . Hence, the output 
entropy is h(y) = 2~ 1 log 2 (27re (E 2 + a 2 )) bits. Accord- 
ing to Shannon theory, the information that is processed 
through this noisy channel can be expressed as the mu- 
tual information between x and y (the amount by which 
the uncertainty on y is reduced by knowing x): 

I (bits) = h(y) - h(y\x) = ~ log 2 (1 + 7 ) (3) 

where 7 = E 2 /cr 2 can be viewed as the signal-to- noise 
ratio (SNR). This is Shannon's famous formula for the 
capacity of a Gaussian additive noise channel Here, 
the signal variance (or power) is simply E 2 , while the 
noise variance is a 2 . This capacity measures the num- 
ber of bits that can be transmitted asymptotically (using 
block coding) per use of the channel, with an arbitrary 
high fidelity for a given SNR. It can be shown to be at- 
tainable if the signal is Gaussian distributed (which is 
the case under consideration here). 

Coming back to our cryptographic setup, consider the 
situation (with no eavesdropping) where Bob performs a 
measurement in the good basis after the latter is publicly 
announced by Alice. (It is equivalent to the more realis- 
tic procedure where Bob measures the key in a random 
basis, but then discards the bad outcomes after the ba- 
sis is disclosed by Alice.) The SNR in basis 1 is simply 
71 = E 2 /cr 2 , while it is 72 = E 2 /<7 2 in basis 2. Using 
this notation, Eq. (||) becomes 1 + 71 = 1 + 72 = 1/a 2 , 
so that we must have the same SNR in both basis, 
7 = e 2 ( r i+'"2) _ 1 This means that the processed in- 
formation is also the same in both bases, and can be 
expressed, using Eq. (||), as 

I (bits) = - log 2 (a) = (n + r 2 )/ ln(2) (4) 

Thus, our continuous quantum cryptographic technique 
can be essentially characterized by a single dimension- 
less constant a (the product of the X\ noise of type-1 
squeezed states times the X 2 noise of type-2 squeezed 
states). It works provided that a < 1, as a finite amount 
of information is then processed from Alice to Bob. Note 
that Iq (expressed in natural units — nats — rather than 
in bits) is simply equal to the sum of the squeeze param- 
eters in bases 1 and 2, which reflects that the processed 
information is zero in the absence of squeezing, and grows 
linearly with squeezing in bases 1 and 2. For example, if 
a\ = a 2 = 1/8, i. e., if we have a squeeze factor e r = \/2 
in each basis, then a = 1/2, so we can process one bit on 
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average per use of the channel. This corresponds to 7 = 3 
in both bases. More generally, we see that the processed 
information in the absence of eavesdropping increases as 
a gets smaller. In some sense, the more we violate a 
pseudo-uncertainty relation o\Oi > 1/4, the larger this 
information gets. Remember that a\ and 02 are standard 
deviations of X\ and X2 measurements on type 1 and 2 
states, respectively. If they referred to X\ and X2 mea- 
surements on a same state, then the above uncertainty 
relation would apply, and Eq. ^ could not be satisfied 
(except for the useless case a = 1). 

The average photon number contained in each encoded 
key state clearly increases with the widening of the dis- 
placement (E 2 ) needed to represent Alice's key values for 
a given SNR. It also increases as squeezing increases, but 
then the displacement distribution can be narrowed to 
achieve a same SNR. Let us determine the relative con- 
tribution of these two effects focusing on one basis, and 
assuming for simplicity that a\ = cr 2 = a so that the 
same squeezing is applied on both quadratures. In this 
case, Eq. (||) implies that a 2 — \e~ 2r , E 2 = ±sinh(2r), 
and 1 + 7 = e 4r . For a given encoded key state (with 
a squeeze parameter r and displacement x, where x is 
the key value Alice wishes to transmit), the mean pho- 
ton number can be written as N = x 2 + sinh 2 r, where 
the first term reflects the displacement effect while the 
second characterizes vacuum squeezing ]l7| |. For a given 
SNR 7 (or a given squeezing parameter r), we obtain the 
average number of photons over all possible values x sent 
by Alice (distributed as a Gaussian of mean and vari- 
ance E 2 ), (N) = E 2 + sinh 2 r. Using the relation between 
7 and r, this gives for the average number of photons per 
key pulse: 

(N) = ^ = e - v ± = ^-^ (5) 

la I I 

Equivalently, the processed information can be expressed 
as a function of the average photon number, 

7 (bits) = log 2 (2 (N) + 1) (6) 

implying that the photon number must increase expo- 
nentially with the processed information. 

We shall now investigate the tradeoff between the in- 
formation acquired by Bob and Eve in this continuous 
cryptographic protocol. First, we should emphasize that, 
even in the absence of eavesdropping, the key elements 
received by Bob are not exactly equal to those sent by 
Alice. This is in contrast with BB84, and is simply due 
to the fact that the noise due to the intrinsic fluctuations 
of the squeezed states always adds to the signal, giving 
rise to a finite SNR. This already holds at Alice's station, 
regardless the (possibly tapped) channel. So, an eaves- 
dropper will be visible in this scheme by an enhanced 
noise variance (or a reduced SNR) at Bob's station. A 
protocol that Alice can follow to detect any eavesdrop- 
ping can be to disclose, on a public channel, the exact 
values x of a random subset of key elements. Then, Bob 



compares them to the received values y and computes 
the distribution of the differences y — x. For a perfect 
and untapped channel, it should be a Gaussian of vari- 
ance a 2 , so the SNR is unchanged. Otherwise, the SNR 
decreases by an amount that can be viewed as a measure 
of the disturbance of the Alice-to-Bob channel. Assume, 
for example, that Eve uses an individual "intercept-and- 
resend" attack, measuring each key element in basis 1 or 
2, at random, and resending a squeezed state centered on 
the value of the measured quadrature. The variance at 
Bob's station is 2<r 2 (twice the intrinsic variance!) if Eve 
used the good basis, or l/(16cr 2 ) in the opposite case, 
so the resulting noise variance is er 2 [l + l/(2a 2 )]. Thus 
Bob's computed SNR is reduced by a factor 2/(3 + 7). 

Let us now make the assumption that the optimal in- 
dividual eavesdropping strategy for Eve consists in using 
the optimal (Gaussian) cloning machine for continuous 
quantum variables |l^,|lj|. This is a very sensible conjec- 
ture as the phase-covariant qubit doner is known to be 
the best individual eavesdropping strategy for BB84 |2(]] 
(actually, the universal qubit doner is optimal for the re- 
lated six-state quantum cryptographic protocol ]2l| , p2| ] ) . 
We consider an attack where Eve makes two imperfect 
copies of the key element, and sends one of them to Bob 
while she keeps the other one. Bob and Eve both wait 
until Alice reveals the basis she used for encoding the 
key before measuring the received state in the appropri- 
ate basis (again, this is equivalent to Bob measuring in a 
random basis and then discarding the bad measurements 
after the basis disclosure). To analyze the information- 
theoretic balance between Bob and Eve, we use a general 
class of asymmetric Gaussian doners defined in Ref. |l§| l 
that result in a different amount of noise on both quadra- 
tures and for Bob and Eve. It is proven in Ref. |l8| that 
the inequality 

°1,B<4,E>1/W (?) 

must hold (and is saturated for this class of doners), 
where af B and a 2 E are the variances of the errors that 
affect Bob's X\ measurements and Eve's X2 measure- 
ments, respectively. For example, if basis 1 is used, 
then the outcomes of X\ measurements on Bob's side 
will be distributed as a Gaussian of variance a\ + a\ B 
since cloning-induced errors are superimposed on the in- 
trinsic fluctuations of the squeezed states. Similarly, 
a second no-cloning uncertainty relation holds, con- 
necting Bob's errors on X2 and Eve's errors on X\: 
a 2B a iE — 1/16- Let us now characterize the don- 
ers that saturate these inequalities by two parameters 
X and 7: we rewrite the error variances on Bob's side 
as a\ B = Xl{°i/ a ) and o\ B — X7~ 1 (c|/a), while the 
errors on Eve's side are written as a 2 E = \ ~ x ^j{o\l a) 
and a\ E = x _1 7 _1 ( cr i/«)- Thus, \ characterizes the 
balance between Bob's and Eve's errors as (Ti.b/ci.e = 
<J2,b/&2,e — X- The limit \ ~~ * corresponds to the case 
where Bob has a negligible cloning-induced additional 
error on his measured quadratures, so he gets the entire 
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information Iq (Eve does not get any information). The 
case x — 1 represents a symmetric situation where the er- 
rors induced by cloning are the same for Bob and Eve. Of 
course, the limit x ~~ * 00 is the opposite situation where 
Eve gets most of the information with no error. Simi- 
larly, 7 describes the quadrature 1 vs 2 balance, that is, 

Now, we need to express the information processed 
from Alice to Bob (or from Alice to Eve) in basis 1 (or ba- 
sis 2). In basis 1, the variance of Bob's measurement out- 
comes is o\ + er 2 g = (l + x7/a)<7i, while the distribution 
of the key elements has a variance £f . Using Shannon's 
formula, Eq. (||), and the identity 1 + £ 2 /c 2 = 1/a 2 , we 
obtain the information processed from Alice to Bob in 
basis 1: 

h,B = -x log 2 - r - (8) 

Similarly, using the variance of Eve's outcomes in basis 2, 
°2 + °2 e = [1 + l/(X7 a )] cr 2; an analogous calculation 
yields for Eve's information in basis 2 

Finally, the balance between Bob's and Eve's information 
can be expressed by calculating the sum of equations (^) 
and (H): 

/i,B+^ = ilog 2 (l/a 2 ) = / (10) 

Remarkably, it appears that the information acquired by 
Eve on the second quadrature, I2,e, is exactly counter- 
balanced by the defect of information at Bob's side on 
the first quadrature, Iq — I\_b- Of course, the counter- 
part of Eq. ([To|) also holds when interchanging the bases, 
that is, J 2) s + h t E = h- 

Thus, assuming that the use of the continuous doner 
is the best possible individual attack against our continu- 
ous cryptographic protocol, Bob's information loss can be 
viewed as a proper disturbance measure as it simply is an 
upper bound on the information that might potentially 
have been gained by an eavesdropper. Consequently, the 
net amount of key bits that can be generated by this 
method is bounded by Ig — Ie = Iq — 21 e- This follows 
from where it is proven that the secret key rate of 
A and B with respect to E is lower bounded by the dif- 
ference of mutual information I{A\B) — I(A;E). Even 
though A, B and E here denote continuous variables, 
we can use this result provided that the generated key 
and the exchanged reconciliation messages are discrete 
as required in Q . Our continuous variables A, B and E 
only appear at the right of the conditional bar in entropy 
formulas, so they can be approximated by discrete num- 
bers (that is, they can be replaced by an integer such as 
[n^4J , approximating the real variable A). As n grows, 
it will soon be close to the real variable with a precision 



far beyond what is needed given the noise level. Thus, 
we conclude that our protocol can only work provided 
that Ie < Io/2, that is, iff x < 1. Stated otherwise, the 
quality of the signals measured by Alice and Bob must 
be bounded by Ib > or in terms of signal-to-noise 

ratios 7' > s/1 + 7 — 1 , where 7' is the SNR measured by 
Bob. This means that a 1-bit channel (7 = 3) may still be 
used if the noise power is almost tripled (7' > 1). In sum- 
mary, the procedure we propose here consists in the quan- 
tum distribution of a (real) Gaussian key, followed by a 
discretization procedure so as to apply some (discrete) 
reconciliation and privacy amplification protocol. Such 
a strategy avoids a weakness of the squeezed-state cryp- 
tosystems as presented in Refs. ]l^-[l^]. There, the key 
is binary (or belong to a larger finite alphabet), so there 
are always gaps between the discrete key values. This al- 
lows Eve to gain knowledge about the occurrences where 
she measured the wrong quadrature (without getting the 
key value). This knowledge alone is sufficient for her to 
attack this key distribution scheme simply by omitting to 
resend the corresponding key elements to Bob, thereby 
faking a small attenuation in the transmission. This lim- 
itation does not apply to our scheme since the continuous 
key values fill in an entire region in the (Ai,A 2 ) phase 
space. 

In conclusion, an all-continuous quantum crypto- 
graphic protocol was proposed that is based on single- 
mode squeezed states of the electromagnetic field. It ex- 
ploits the uncertainty relation between the conjugate pair 
of quadrature components X\ and A 2 by encoding a con- 
tinuous Gaussian-distributed key into either X\- or A 2 - 
squeezed states, thereby allowing a continuous key distri- 
bution between two remote parties. It is shown that the 
information acquired by an eavesdropper on the key ele- 
ments encoded in X\ is compensated by a reduction (by 
a same amount) of the key information available on the 
X2 amplitude at the receiver's station. This information- 
theoretic tradeoff characterizes the worst-case individual 
attack based on the cloning machine, so we conclude that 
the loss of information at the receiver's end is a good up- 
per bound on the tapped information. A realization of 
this continuous protocol based on squeezed states would 
be very challenging, as the generation of squeezed light 
has been a difficult experimental target for years. Also, 
it would require synchronized local oscillators at Alice's 
and Bob's stations, in order for them to have a common 
phase for homodyne detecting the amplitudes X\ and A 2 . 
In addition, probably the main limitation in the imple- 
mentation of this protocol is related to the loss of squeez- 
ing effected by attenuation in the transmission medium. 
This would dramatically decrease the SNR, and make 
the protocol less efficient (or insecure). In analogy with 
what is known for BB84, there probably is a threshold 
on the squeeze parameter that Alice should reach, below 
which the protocol would fail. Nevertheless, it should 
be stressed that the cryptographic protocol proposed 
here was analyzed using the conjugate pair X\ and A 2 , 
but other complementary variables might be exploited as 
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well. In particular, one could possibly imagine a contin- 
uous cryptographic scheme based on the time-frequency 
complementarity, where ultra-short single-photon pulses, 
or, alternatively, single-photon pulses that are highly re- 
solved in frequency would be used in order to encode the 
Gaussian key. Such a scheme might possibly avoid some 
of the weaknesses of the squeezed state protocol, and be 
more appropriate for an experimental realization. 
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